Week 8: Part 2 - Hands-on Vulnerability Management with Nessus

In this lab you will set up a Linux-based security workstation, install Nessus Essentials, deploy a vulnerable machine, and run a full vulnerability scan.

This task is the same one as Part three in your Assessment1.

Lab Overview

You will work with two virtual machines:

• Kali Linux: your security analyst machine where Nessus runs.
• Metasploitable 3: the vulnerable target you will scan.

Both machines must be on the same Host-only or NAT network.

Step 1 - Deploy Kali Linux (Security Analyst Machine)

Use your usual Kali VM. If you do not already have one, download the Kali VM image:

Download Kali VM (VirtualBox OVA)

You will use Kali to:

• Install and configure Nessus Essentials
• Request and activate the Nessus licence
• Create and run scans
• Review and export reports

Step 2 - Install Nessus Essentials on Kali Linux

1. Get a Licence

1. Visit:https://www.tenable.com/tenable-for-education/nessus-essentials
2. Register using your e-mail.
3. Note your activation code.

2. Download Nessus

1. Visit: https://www.tenable.com/downloads/nessus
2. Download the correct .deb package for your Kali:
   • AMD64 for most standard installs
   • ARM64 if you are using an ARM-based VM
3. Save the installer file.

3. Prepare and Install

• Update Kali (not essential):

  sudo apt update 
  

• Change to the directory where your Nessus installer was saved.
  For example, if it is in the Downloads folder:

  cd ~/Downloads
  

• Install Nessus (if your file names is :Nessus-10.10.1-ubuntu1804_aarch64):

  sudo dpkg -i Nessus-10.10.1-ubuntu1804_aarch64.deb
  

  change the file name if required:

4. Start Nessus

sudo systemctl start nessusd.service

(Optional):

sudo systemctl enable nessusd.service

5. Open the Web Interface

In a browser on Kali:

https://localhost:8834/

Continue past any certificate warning.

Complete setup:

1. Select Nessus Essentials
2. Enter your activation code that got sent to you email.
3. Create your admin account (something simple)
4. Wait for plugins to download and build (this takes several minutes)

Nessus is now ready.

Step 3: Deploy Metasploitable 3 (Target Machine)

• Download and extract the Metasploitable 3 OVA file.
• For Metasploitable3, username:vagrant, password:vagrant

You will:

• Import the OVA into VirtualBox
• Start the VM
• Ensure it is on the same network as Kali (NAT Network or Host-only)
• Confirm its IP address

This VM will be the target for your Nessus scans.

You Are Ready to Start Scanning

Once both machines are running:

• Nessus on Kali is your scanner
• Metasploitable 3 is your target

You can now move on to creating your first vulnerability scan.

Task 1 - Running a Scan Against Metasploitable 3

1. Start both VMs: Kali (with Nessus) and Metasploitable 3.
2. Confirm the Metasploitable 3 IP address using ifconfig or any other method.
3. In Nessus, create a New Scan (You can use Basic Network Scan )and set the target to the Metasploitable 3 IP.
4. Launch the scan and wait for it to complete (this may take several minutes).

Task 2 - Reviewing the Scan Report

1. Open the completed scan report in Nessus.
2. Export the report
3. Identify at least three vulnerabilities from the findings.
4. Record them in the table below:

Task 3 - Verifying CVEs and Mapping to CWE

For each vulnerability you selected:

1. Look up the CVE on https://www.cve.org/ to confirm the official description.
2. Find the corresponding CWE category on https://cwe.mitre.org/.
3. Add the information to your table:

Task 4 - Manual CVSS v4.0 Scoring

Select two of the CVEs from your list.

1. Open the CVSS v4.0 calculator:
   https://www.first.org/cvss/calculator/4.0
2. Score each vulnerability manually:
   • Base Metrics
   • Threat Metrics
   • Environmental Metrics (use High Confidentiality, High Integrity, Medium Availability)
3. Record your final vectors and scores.
4. Compare your results with the Nessus score.
   Write a short explanation of why they may differ (for example: CVSS version, vendor weighting, missing metrics).

Task 5 - Prioritisation with KEV and EPSS

1. Check whether your CVEs appear in the CISA KEV Catalogue (Known Exploited Vulnerabilities).
2. Re-rank your vulnerabilities by urgency using:
   • CVSS score
   • KEV exploitation status
3. Write a short reflection on how KEV changed your prioritisation.

Resources:

• CVE - https://www.cve.org/

• CWE - https://cwe.mitre.org/

• CVSS - https://www.first.org/cvss/

• Nessus - https://www.tenable.com/products/nessus/nessus-essentials